# CVE-2026-93597: ArcadeDB SSRF bypass via IPv6 transition address validation

Source: https://junglewise.ai/threats/cve-2026-93597-arcadedb-ssrf-bypass-via-ipv6-transition-address-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93597 · Severity: high · CVSS 7.7 · Published 2026-09-18

ArcadeDB is a NoSQL database that provides import and server restore functionality. Authenticated users can exploit incomplete IPv6 address validation in the SSRF protection to reach internal services and cloud metadata endpoints by supplying specially crafted hostnames. This allows attackers with import permissions to exfiltrate sensitive data from systems that should be protected from external access.

## Quick answers

**Is CVE-2026-93597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93597 being exploited in the wild.

**How severe is CVE-2026-93597?** High severity, with a CVSS score of 7.7, published 18 September 2026.

**Which products and versions are affected?** ArcadeDB ArcadeDB before 26.9.1.

**Is there a fix for CVE-2026-93597?** A patch was published on 2026-09-18: version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93597 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93597?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in ImportSecurityValidator.isBlockedAddress() and PostServerCommandHandler.isBlockedHost(), which use Java InetAddress flag methods to block requests to internal addresses. These methods fail to detect IPv6 transition addresses (NAT64, 6to4, Teredo) that embed RFC 1918 private or loopback IPv4 addresses. An attacker with IMPORT DATABASE or server command permission can supply a URL that resolves to one of these transition forms (e.g., 64:ff9b::c0a8:0101 for NAT64-encoded 192.168.1.1) to bypass the SSRF guard. The SafeHttpFetcher's redirect-following and DNS-pinning mitigations do not compensate because the attacker can point directly to a transition address via DNS, avoiding redirects. Patched in version 26.9.1.

## Affected products

- ArcadeDB ArcadeDB before 26.9.1

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: version 26.9.1

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh)
- [https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-ssrf-via-ipv6-transition-addresses](https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-ssrf-via-ipv6-transition-addresses)